Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-56004: obs-service-tar_scm: Malicious Mercurial File Can Execute Code
CVE-2026-56004
CVE-2026-56004
Summary
The obs-service-tar_scm software has a vulnerability in its Mercurial handler. If an attacker can trick the service into checking out a malicious _service file, they can execute code as the service or the local user. This is a serious issue because it allows an attacker to gain control of the system, so update to version 0.12.4 or later to fix the problem.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| opensuse | buildservice | < 0.12.4 |
Original title
obs-service-tar_scm: command injection via mercurial handler
Original description
A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services
mitre CVSS3.1
8.8
Vulnerability type
CWE-78
OS Command Injection
Published: 2 Jul 2026 · Updated: 23 Jul 2026 · First seen: 2 Jul 2026